Alan Stern
c53234d8a4
HID: hidraw: Fix invalid read in hidraw_ioctl
commit 416dacb819 upstream.
The syzbot fuzzer has reported a pair of problems in the
hidraw_ioctl() function: slab-out-of-bounds read and use-after-free
read. An example of the first:
BUG: KASAN: slab-out-of-bounds in strlen+0x79/0x90 lib/string.c:525
Read of size 1 at addr ffff8881c8035f38 by task syz-executor.4/2833
CPU: 1 PID: 2833 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
print_address_description+0x6a/0x32c mm/kasan/report.c:351
__kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
kasan_report+0xe/0x12 mm/kasan/common.c:612
strlen+0x79/0x90 lib/string.c:525
strlen include/linux/string.h:281 [inline]
hidraw_ioctl+0x245/0xae0 drivers/hid/hidraw.c:446
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7a68f6dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
RDX: 0000000000000000 RSI: 0000000080404805 RDI: 0000000000000004
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7a68f6e6d4
R13: 00000000004c21de R14: 00000000004d5620 R15: 00000000ffffffff
The two problems have the same cause: hidraw_ioctl() fails to test
whether the device has been removed. This patch adds the missing test.
Reported-and-tested-by: syzbot+5a6c4ec678a0c6ee84ba@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-05 12:30:06 +02:00
..
2019-04-27 09:34:47 +02:00
2019-04-05 22:29:14 +02:00
2019-08-25 10:51:44 +02:00
2019-09-06 10:19:33 +02:00
2016-10-07 09:59:48 +02:00
2018-10-10 08:53:20 +02:00
2015-11-05 09:51:50 -08:00
2016-04-04 09:59:21 +02:00
2015-10-21 13:15:53 +02:00
2017-12-14 09:28:18 +01:00
2016-03-02 10:31:36 +01:00
2019-05-31 06:48:29 -07:00
2017-12-25 14:23:37 +01:00
2017-12-20 10:07:26 +01:00
2017-01-15 13:42:56 +01:00
2019-05-08 07:19:08 +02:00
2016-10-10 10:52:01 +02:00
2015-10-21 13:15:53 +02:00
2018-03-22 09:17:53 +01:00
2015-08-18 15:03:43 +02:00
2015-11-05 10:15:35 -08:00
2015-12-28 13:41:44 +01:00
2019-08-25 10:51:44 +02:00
2019-08-11 12:22:14 +02:00
2019-05-16 19:43:41 +02:00
2016-09-19 14:32:22 +02:00
2016-10-10 10:47:03 +02:00
2019-02-12 19:44:59 +01:00
2019-10-05 12:30:06 +02:00
2016-09-26 15:39:54 +02:00
2019-10-05 12:30:06 +02:00
2019-05-31 06:48:18 -07:00
2016-11-23 17:43:25 +01:00
2017-04-12 12:41:16 +02:00
2018-04-24 09:34:11 +02:00
2018-10-03 17:01:47 -07:00
2016-03-10 17:17:26 +01:00
2015-06-29 14:51:12 +02:00
2015-06-29 14:51:12 +02:00
2015-06-29 14:51:12 +02:00
2015-12-28 13:41:44 +01:00
2018-08-03 07:55:21 +02:00
2019-10-05 12:30:06 +02:00
2018-04-24 09:34:11 +02:00
2015-12-28 13:41:51 +01:00
2015-12-28 13:41:51 +01:00
2015-12-28 13:41:51 +01:00
2015-12-28 13:41:51 +01:00
2015-12-28 13:41:51 +01:00
2018-05-30 07:50:21 +02:00
2015-12-28 13:41:51 +01:00
2015-12-28 13:41:51 +01:00
2016-04-04 09:49:12 +02:00
2018-10-10 08:53:20 +02:00
2016-11-05 16:56:09 +01:00
2017-04-12 12:41:16 +02:00
2018-09-29 03:07:35 -07:00
2015-12-28 13:41:44 +01:00
2019-09-06 10:19:31 +02:00
2016-09-19 14:32:24 +02:00
2016-09-19 14:32:21 +02:00
2016-03-18 17:31:38 +01:00
2015-12-28 13:41:44 +01:00
2017-12-25 14:23:40 +01:00
2019-10-05 12:30:06 +02:00
2017-12-25 14:23:37 +01:00
2016-08-17 11:13:07 +02:00
2018-11-27 16:09:42 +01:00
2018-04-24 09:34:11 +02:00
2019-09-06 10:19:36 +02:00
2016-10-07 09:59:48 +02:00
2016-08-05 13:39:23 +02:00